{"id":"CVE-2026-88387","details":"LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service.","modified":"2026-09-26T08:04:16.771668Z","published":"2026-09-24T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88387.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88387.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88387"},{"type":"REPORT","url":"https://github.com/LibRaw/LibRaw/issues/844"},{"type":"FIX","url":"https://github.com/LibRaw/LibRaw/commit/b41cbbd61951783e0440590dae55411a16185bdf"},{"type":"FIX","url":"https://github.com/LibRaw/LibRaw/pull/853"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libraw/libraw","events":[{"introduced":"0"},{"fixed":"b41cbbd61951783e0440590dae55411a16185bdf"}],"database_specific":{"source":"REFERENCES"}}],"versions":["0.22.0","0.21.1","0.21.0","0.21-Beta1","0.20.2","0.20.1","0.20.0","0.20-RC2","0.18.0","0.17.0","0.16.0","0.15.0","0.14.6","0.14.5","0.14.4","0.14.3","0.14.2","0.14.1","0.14.0","0.13.6","0.13.5","0.13.4","0.13.3","0.13.2","0.13.1","0.13.0","0.12.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88387.json","vanir_signatures_modified":"2026-09-26T08:04:16Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/libraw/libraw/commit/b41cbbd61951783e0440590dae55411a16185bdf","target":{"file":"src/metadata/tiff.cpp","function":"LibRaw::parse_tiff_ifd"},"deprecated":false,"digest":{"function_hash":"337752385910102631819381698114615574847","length":45205},"id":"CVE-2026-88387-256cdd68","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libraw/libraw/commit/b41cbbd61951783e0440590dae55411a16185bdf","target":{"file":"src/metadata/tiff.cpp"},"deprecated":false,"digest":{"line_hashes":["12850586628985013244243968180152103302","255198855738586462950454382922357020704","184935694068620877495365105723337493893","300441226201711283685360790119275464643"],"threshold":0.9},"id":"CVE-2026-88387-402f22e9"}]}}],"schema_version":"1.9.0"}